arXiv:1504.05628vl [quant-ph] 22 Apr 2015 


Key Rate of the B92 Quantum Key Distribution 
Protocol with Finite Qubits 

Hiroaki Sasaki*, Ryutaroh Matsumoto*, and Tomohiko Uyematsu* 

*Department of Communications and Computer Engineering, Tokyo Institute of Technology, Japan. 


Abstract —The key rate of the B92 quantum key distribution 
protocol had not been reported before this research when the 
number of qubits is finite. We compute it by using the security 
analysis framework proposed by Scarani and Renner in 2008. 
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I. Introduction 

The B92 quantum key distribution (QKD) protocol 0 
has remained less popular than the famous BB84 protocol 
ifTl , while both protocols provide the unconditional security. 
One plausible reason for the unpopularity is that the B92 is 
weaker to the channel noise than the BB84. Specifically, the 
BB84 with the standard one-way information reconciliation 
can generate secure key over the depolarizing channel at 
depolarizing rate 16.5%, while the previous security analyses 
of the B92 cannot guarantee the secure key generation at 
depolarizing rate 3.5% Ifl3l . 3.7% 0 or 4.2% ||T0| . By using 
the security analysis framework introduced by Renner in 2005 
0, we improved the maximal tolerable depolarizing rate to 
6.5% 0 . 

All of the above analyses 0 , 0 , flOl . lU~3l assumed the 
infinite number of qubits in the protocol, and derived the 
asymptotic key rates. On the other hand, in practice the number 
of qubits used in a protocol is always finite. However, before 
this research, the key rates with finite qubits in the B92 
protocol had not been reported, as far as the authors know. 
In this paper, we report the key rates with finite qubits, based 
on the analytic framework introduced by Scarani and Renner 
133 and our previous researches 0 , 03 ]. We stress that the 
assumption in our paper is the same as fl2l . and in particular 
we assume the collective attack instead of the coherent attack. 

II. New Security Analysis of the B92 Protocol with Finite 
Qubits 

In this section, we present a new formula for the key rate 
of the B92 protocol with finite qubits, based on previous 
researches 0 , 1331 , 133 - The following description has some 
overlap with our previous research improving the asymptotic 
key rate of the B92 0 . Firstly, we fix notations. Let (|0), 

11)} be some fixed orthonormal basis of a qubit. In the B92 
protocol 0, Alice sends the quantum state 

YPj) =jS|0) + (-iy'a|l), (1) 

for j = 0,1, where fi = V1 - a 2 , and 0 < a < 1/V2. For 
convenience of presentation, we also define 

|^> = a|0>-(—iy/J|l>. 


We can see that {| ipf), \tpj)} forms an orthonormal basis of a 
qubit. 

On the other hand, we can express a qubit channel as 
follows. Define the three Pauli matrices cr x , cr y , and <:r z as 
usual. Then a qubit density matrix p can be expressed as 0 

P = ^ (/ + xcr x + yo-y + zo%), 

where x,y,z € R and x 2 + y 2 + r < 1. The vector (x,y, z) 
is called a Bloch vector. The qubit channel Sb from Alice to 
Bob can be expressed |6) as a map between Bloch vectors by 
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As in 133 , we also define the four POVM 


( 2 ) 

(3) 


F 0 = lfrXfrl/2, (4) 

Fi = \<Po)m/2, (5) 

F q = I^X^I/2, (6) 

Fi = \<poX<Po\/2. (2) 


In 133 , the measurement outcomes corresponding to Fq and 
F j was not distinguished. We distinguish them for better 
channel estimation. 

After passing the quantum channel Sb from Alice to Bob, 
| V F)( V F| becomes 


PMH = (/®fifl)l’P)<T|. (8) 

In a quantum key distribution protocol, the state change Sb 
is caused by Eve’s cloning of the transmitted qubits to her 
quantum memory. The content of Eve’s quantum memory is 
mathematically described by the purification |<Diare) of P\.,\b- 
Let pi'ABE — I^mbeX^mbeI- 

In addition to Eve’s quantum memory, she also knows the 
content of public communication over the classical public 
channel between Alice and Bob. For each transmitted qubit 
from Alice to Bob, the public communication consists of 1- 
bit information indicating whether Bob excludes his received 












qubit for generating the final secret key or not. We also 
have to take it into account. We shall represent the public 
communication by a classical random variable P that becomes 
1 if Bob excludes his qubit and 0 otherwise. So, P — 0 when 
Bob’s measurement outcome is Fq or F i, and P — 1 when 
Bob’s measurement outcome is Fq or Fj. 

On the other hand, in the B92 protocol. Bob performs the 
measurement specified by Eqs. 0-0- Alice and Bob use 
their qubit for generation of the final secret key only if its 
measurement outcome is Fq or F\. Otherwise it is excluded 
from the key generation. This is mathematically equivalent to 
set Alice’s bit to 0 if the measurement outcomes is Fq or 
F\. Therefore, from Eve’s perspective on Alice’s classical bit, 
the joint state between Alice and Bob after the selection by 
measurement outcomes is equivalent to 

PlABEP = (IA ® yfpQ ® IeP\ABeIa ® V^o ® Ie 

+Ia ® ® I Ep\ a be I a ® ® Ie) ® |0)/>(0|p 

+|0)a(0|a ® ( v/Fg ® IeT*a[p\abe\ a[Fq ® h: 

+ -y/Fj"® Ie^a[P\abe\ ® Ie) ® |1)p(1|p- 

Observe that the state change from P\,abe to piabep is a trace¬ 
preserving completely positive map. 

In order to calculate the key rate, we need to consider Eve’s 
ambiguity on Alice’s classical bit fTOj . |9l defined as follows. 
Let 

P2.XEP = ^ It)aO’U ® IEP^B\_PlABEp)\j)A O'U ®IeP- 

i= 0,1 

Eve’s ambiguity on Alice’s classical bit S (X\EP) is defined as 

5 (X| EP) = S (p 2 ,xEp) ~ S (p 2 ,Ep), (9) 

where P 2 ,ep = Tr a\P 2 .xep], and S(-) denotes the von Neumann 
entropy. 

In order to calculate the amount of public communication 
required for information reconciliation, we define the joint 
random variables ( X ', Y') as 

X' = j if the transmitted qubit is | <pj), 

Y' = k if the measurement outcome is F*, (10) 


under the condition that the measurement outcome is either 
Fq or /-j. Observe the difference between X and X'. X' is not 
defined but X is defined to be 0 when Bob’s measurement 
outcome is either Fq or Fj. 

We shall show the key rate per single transmitted qubit that 
is neither announced for the channel estimation nor excluded 
due to the measurement outcome being Fq or Fj. Note that 
Eq. 0 is Eve’s ambiguity per a qubit that is not announced for 
the channel estimation but can be discarded. The probability 
of the measurement outcome being Fo or Fi is 

'IAP\ab(Ia ® (Fq + Fi))]. 


So we can see that Eve’s ambiguity per single transmitted 
qubit that is neither announced for the channel estimation nor 
discarded is 

S(X\EP) 

Tr Ipiab(I ® (Fq + Fj))] 


By IfTOj , 191 the asymptotic key rate is 


S(X\EP) 

Tr[pi,A/i(/ ® (F 0 +Fi»] 


H(X'\Y'). 
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The above analysis is almost the same as our previous one 0 
for the asymptotic key rate assuming the infinite number of 
qubits. 

Note that the above formula CQ} assumes that Alice and 
Bob know the channel between them. In the BB92 protocol, 
we cannot estimate all the parameters of the channel, even if 
we assume infinitely many qubits in the protocol. We can only 
estimate part of them. In addition to that, because the number 
of qubits in the protocol is finite, there must be statistical 
errors. 

To handle the finiteness of qubits, Scarani and Renner fl2l 
used the interval estimation of channel parameters (R and t 
of 0 in our study). In contrast to the more popular point 
estimation, by using statistical samples, interval estimation 
gives a set of parameters that contains true parameters with 
high probability 1 - ep E . By using the results in 111 21 . the key 
rate of the B92 protocol can be computed as 


r= min S(X\EP) - H(X'\Y') - A/n, (12) 

(S,f5er(epE) 

where r(ep E ) is a confidence region given by an interval 
estimation procedure with the confidence level > 1 — ep E , A is 
as defined in llT~2l Eq. (5)], and n is the number of the qubits 
to which Alice and Bob apply the privacy amplification. 

To compute the rate (IT2l >. there are two remaining tasks, 
namely (a) computation of r(e PE ), and (b) computation of 
mm iRi)er(£fE) S(X\EP). Task (b) is performed by using the 
convex optimization method 0 as done in our previous 
researches 0, DU- For convex optimization, the confidence 
region r(ep E ) must be a convex set that can be easily handled 
by a mathematical software, like Mathematica. In ED, such 
a convex confidence region was introduced for the BB84 
protocol by using the KL divergence. We shall define E(epE) 
also by using the KL divergence. 

In the conventional researches 0, 0, DEI, ED, their 
channel estimation procedures classified Bob’s measurement 
outcomes into three categories, namely, Fo, F\ and the incon¬ 
clusive (Fq or Fj). In this research, we propose to distinguish 
Fq and Fj for better estimation accuracy. On the other hand, 
the conventional estimation procedures did not distinguish 
which |y?o) or W\) produced Bob’s measurement outcome. We 
also propose to distinguish Alice’s transmitted qubits \<pq) and 
\<pi) in channel estimation. 

By the above consideration, the proposed channel estimation 
procedure has at least 8 kinds of outcomes. On the other 
hand, the treatment of Bob’s outcome Fq, Fj, Fq and Fj is 
asymmetric, because all of Fq and Fj are disclosed to Alice 
and are used for channel estimation, while parts of Fq and F \ 
are kept secret for the secret key generation. Because of this 
asymmetry, the sum of 8 POVM operators corresponding the 
above 8 outcomes does not become the 4x4 identity matrix 
1 4 x 4 - To make the sum equal to 74 * 4 , we include the outcome 
meaning the qubit kept secret for secret key generation. By 
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r pu b(() < r pu b < 1) we denote the conditional probability for a 
qubit being disclosed for channel estimation, and the qubit is 
kept secret for secret key generation with a probability r pub . 
We define the following 8 POVM operators: 

E 0 

= 


(13) 

Ei 

= 


(14) 

e 2 
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|0a)<0aI®E 5 

(15) 

e 3 

= 

|0a>(0a|®Fi 

(16) 

Ea 

= 

fpub\ 1a)(1aI ® Fq 

(17) 

e 5 

= 

r pu b\^A){^A\®F\ 

(18) 

e 6 

= 

IUXUI®Fo 

(19) 

e 7 

= 

|1aXUI®Fi 

(20) 

Es 

= 

(1 - r pub )I 2 x 2 ® ( Fq + F i). 

(21) 

The last operator Eg corresponds to the imaginary measure- 


ment outcome expressing the non-disclosure of a qubit. 

By this preparation of notations, we can describe the 
proposed confidence region of the channel parameters. Let 
D(P\\Q) denotes the Kullback-Leibler divergence, M£\,ab) the 
theoretical probability distribution of the 9 outcomes defined 
as 

doo(pi,Afi) = (Tr[pi j A B £’o],..., Trfpi^B’g]), 


and A m the empirical distribution (i.e. relative frequencies) 
of the 9 outcomes, where m is the total number of qubits 
transmitted including both disclosed and non-disclosed qubits. 
Observe that Alice and Bob can compute A m in the protocol 
execution, and their task is to estimate the channel parameters 
(R, 7 ). The set 

{(Rj) | £>(/U|/loo(pi,Afl)) < epE ,(R,t] defines a CP map) 

( 22 ) 

is a confidence region of (R, 7 ) with confidence level at least 
1 - epE, by the well-known fact 0 Theorem 11.2.1], It is also 
well-known that the set of (R, 7 ) yielding a CP map is convex 
0, and Z)('||') is a convex function. Therefore the set ( 1221 is a 
convex set. The above idea is similar to our previous research 
iffD on BB84. We have verified that the set (f22l i can be used 
as r(e PE ) in (fl2l >. 

The minimization in (fl2t is just a convex optimization 
and can be done as follows. Observe first that S ( X\EP ) is 
a function of the channel parameters <0 of & B . By the 
almost same argument as m Remark 11] one sees that 
S ( X\EP ) is a convex function of the channel parameters 0. 
Moreover, we see that the minimum of S(X\EP) is attained 
when R xy = R yx - R vz = R zy = t y = 0 by the almost same 
argument as El Proposition 1]. Therefore, one can compute 
the minimization of S ( X\EP ) by the convex optimization 0. 


III. Numerical Result 

We consider the depolarizing channel E> q with depolarizing 
rate q. The definition of q follows E- For a qubit density 
matrix p, we have E> q (p) = (1 - q)p + (q/2)I 2x2 . With such a 



depolarizing rate 


Fig. 1. Key rates with various depolarizing rates of the quantum channel 



Fig. 2. Key rates with various sample sizes (depolarizing rate is 5%) 


channel S q , R and 7 in Eq. 0 are given by 


R = 


-4q/3 

0 

0 


0 

-4q/3 

0 


0 

-4q/3 


7= 0. 


We stress that we do not restrict the range of minimization 
in dTH) to the depolarizing or the Pauli channels. The mini¬ 
mization is carried out over the set of all the qubit channels 
in (l22l >. The FindMinimum function in Mathematica 9.0 was 
used for the minimization. 

In Fig. Q] the key rates for various depolarizing rates are 
plotted, and we compare key rates by our proposal and the 
asymptotic rates by Matsumoto 0. We can observe that 
positive key rate is achieved at depolarizing rate 6.4% with 
10 8 samples. The sample size refers to the total number m 
of transmitted qubits from Alice to Bob, including qubits 
giving measurement outcomes Fq and F {) and qubits becoming 
sifted key. In Fig. [2] the key rates for various sample sizes 
are plotted with a fixed depolarizing rate 5%, and we also 
compare key rates by our proposal and the asymptotic rates 
by Matsumoto 0. We can observe that our key rates converge 
to the asymptotic one. We only considered a = 0.39 and did 
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not optimize the value of a in Eq. (jT|). The value a = 0.39 was 
also used in (7|. r pu b was always set to 0.5 in our numerical 
computation. 


IV. Conclusion 

Before this research, the secure key rate of the B92 quantum 
key distribution protocol had not been reported. We have 
clarified it. Our analysis is based on the finite key rate formula 
proposed by Scarani and Renner E) combined with our 
previous researches GO, ED- We have shown that one can 
have a positive key rate with 10 X samples over a depolarizing 
channel with depolarizing rate 6.4%. 
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